rules/cloud/azure/azure_app_device_code_authentication.yml

title: Application Using Device Code Authentication Flow
id: 248649b7-d64f-46f0-9fb2-a52774166fb5
status: experimental
description: |
    Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
    If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
    This can be a misconfigured application or potentially something malicious.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022/06/01
tags:
    - attack.t1078
    - attack.defense_evasion
    - attack.persistence
    - attack.privilege_escalation
    - attack.initial_access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: Device Code
    condition: selection
falsepositives:
    - Applications that are input constrained will need to use device code flow and are valid authentications.
level: medium
Update azure_app_device_code_authentication.yml 2022-06-02 13:58:37 +02:00			`title: Application Using Device Code Authentication Flow`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`id: 248649b7-d64f-46f0-9fb2-a52774166fb5`
Update azure_app_device_code_authentication.yml 2022-06-02 13:50:49 +02:00			`status: experimental`
$frack113$ Update and rename azure_app_device_code_authentication to azure_app_device_code_authentication.yml 2022-06-02 06:20:26 +02:00			`description: \|`
$frack113$ Order yaml field 2022-10-25 07:34:10 +02:00			`Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.`
			`If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.`
			`This can be a misconfigured application or potentially something malicious.`
			`references:`
			`- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'`
			`date: 2022/06/01`
$frack113$ Order yaml field 2022-10-25 07:34:10 +02:00			`tags:`
			`- attack.t1078`
			`- attack.defense_evasion`
			`- attack.persistence`
			`- attack.privilege_escalation`
			`- attack.initial_access`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`logsource:`
$frack113$ Order yaml field 2022-10-25 07:34:10 +02:00			`product: azure`
			`service: signinlogs`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`detection:`
$frack113$ Order yaml field 2022-10-25 07:34:10 +02:00			`selection:`
			`properties.message: Device Code`
			`condition: selection`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`falsepositives:`
$frack113$ Order yaml field 2022-10-25 07:34:10 +02:00			`- Applications that are input constrained will need to use device code flow and are valid authentications.`
Create azure_app_device_code_authentication 2022-06-01 10:59:03 -07:00			`level: medium`